IAM Identity Center Permission Set Deletion Failure Due to Orphaned ApplicationProfile Association

This article addresses a common issue where users are unable to delete IAM Identity Center permission sets due to orphaned internal ApplicationProfile associations. The deletion fails with a 409 ConflictException error indicating that the permission set has an ApplicationProfile associated with it. Even though no users or groups are assigned, the permission sets remain provisioned in target AWS accounts, blocking deletion via console, CLI, or Infrastructure as Code (IaC) tools such as Terraform.

---

Problem Description

When attempting to delete an IAM Identity Center permission set that is no longer assigned to any users or groups, the operation fails with the following error:

operation error SSO Admin: DeletePermissionSet, exceeded maximum number of attempts, 25,
https response error StatusCode: 400,
ConflictException: Could not delete because PermissionSet has ApplicationProfile associated with it

Additionally:

• Attempting to remove the permission set from the AWS account via the IAM Identity Center console (AWS accounts → account → Permission sets → Remove) appears to succeed but the permission set remains provisioned after refreshing the page.
• Running terraform apply after removing the permission set from Terraform configuration succeeds in deleting managed policy attachments and customer managed policy attachments, but fails on the DeletePermissionSet operation with the same ConflictException.
• Every subsequent Terraform apply continues to fail, blocking the IaC pipeline.

---

Root Cause

When IAM Identity Center provisions a permission set to a target AWS account, it creates internal ApplicationProfile associations that link the permission set to the account. Under normal circumstances, these associations are removed when all user/group assignments are deleted and the permission set is de-provisioned from the account.

However, in certain scenarios, the internal ApplicationProfile association becomes orphaned — the user/group assignments are removed, but the permission set remains in a "provisioned" state with a stale ApplicationProfile dependency. This prevents the DeletePermissionSet API from completing.

Key factors contributing to this issue:

• The permission set shows as "provisioned" in the target AWS account despite having no active user or group assignments
• The list-account-assignments API returns an empty array, confirming no assignments exist
• The list-applications API does not surface the internal ApplicationProfile, as it is a service-level resource not exposed through customer-facing APIs
• The console removal action fails silently — the UI appears to process the request but the permission set remains provisioned
• The DeletePermissionSet API returns a ConflictException (HTTP 400), which is non-retryable, causing retry loops to exhaust without resolution

---

Verification

To confirm the issue, run the following commands:

Step 1: Attempt to delete the permission set and observe the ConflictException:

aws sso-admin delete-permission-set \
  --instance-arn "arn:aws:sso:::instance/ssoins-<instance-id>" \
  --permission-set-arn "arn:aws:sso:::permissionSet/ssoins-<instance-id>/ps-<permission-set-id>"

Expected error:

ConflictException: Could not delete because PermissionSet has ApplicationProfile associated with it
(Service: SSOAdmin, Status Code: 400)

Step 2: Verify no active user/group assignments exist:

aws sso-admin list-account-assignments \
  --instance-arn "arn:aws:sso:::instance/ssoins-<instance-id>" \
  --permission-set-arn "arn:aws:sso:::permissionSet/ssoins-<instance-id>/ps-<permission-set-id>" \
  --account-id "<target-account-id>"

If the AccountAssignments array is empty, this confirms no assignments exist and the issue is an orphaned ApplicationProfile.

Step 3: Check for any customer-managed applications linked to the permission set:

aws sso-admin list-applications \
  --instance-arn "arn:aws:sso:::instance/ssoins-<instance-id>"

If no relevant applications are returned (or only unrelated applications like Amazon QuickSight appear), this confirms the blocking dependency is an internal service-level ApplicationProfile.

Step 4: Verify the permission set is still provisioned in the target account by checking the IAM Identity Center console under AWS accounts → select the target account → Permission sets. The permission set will appear listed despite having no assignments.

---

Resolution

The root cause is that the permission set remains provisioned in the target AWS account without any active assignments. To force a proper de-provisioning, create a temporary account assignment and then delete it. This triggers the IAM Identity Center backend to clean up the ApplicationProfile association.

Step 1: Create a Temporary (Dummy) Account Assignment

aws sso-admin create-account-assignment \
  --instance-arn "arn:aws:sso:::instance/ssoins-<instance-id>" \
  --permission-set-arn "arn:aws:sso:::permissionSet/ssoins-<instance-id>/ps-<permission-set-id>" \
  --target-type AWS_ACCOUNT \
  --target-id "<target-account-id>" \
  --principal-type USER \
  --principal-id "<any-valid-idc-user-id>"

You can use any valid IAM Identity Center user or group for this temporary assignment. To use a group instead, change --principal-type to GROUP and provide a valid group ID.

Step 2: Delete the Temporary Account Assignment

aws sso-admin delete-account-assignment \
  --instance-arn "arn:aws:sso:::instance/ssoins-<instance-id>" \
  --permission-set-arn "arn:aws:sso:::permissionSet/ssoins-<instance-id>/ps-<permission-set-id>" \
  --target-type AWS_ACCOUNT \
  --target-id "<target-account-id>" \
  --principal-type USER \
  --principal-id "<same-user-id-from-step-1>"

Step 3: Verify the Permission Set is De-provisioned

Check the IAM Identity Center console under AWS accounts → target account → Permission sets. The permission set should no longer appear as provisioned.

Alternatively, confirm via CLI:

aws sso-admin list-accounts-for-provisioned-permission-set \
  --instance-arn "arn:aws:sso:::instance/ssoins-<instance-id>" \
  --permission-set-arn "arn:aws:sso:::permissionSet/ssoins-<instance-id>/ps-<permission-set-id>"

The AccountIds array should no longer contain the target account.

Step 4: Delete the Permission Set

aws sso-admin delete-permission-set \
  --instance-arn "arn:aws:sso:::instance/ssoins-<instance-id>" \
  --permission-set-arn "arn:aws:sso:::permissionSet/ssoins-<instance-id>/ps-<permission-set-id>"

Step 5: Repeat for Each Affected Permission Set and Account

If a permission set is provisioned in multiple target accounts, repeat Steps 1–3 for each target account before attempting deletion in Step 4.

After completing these steps, the permission set will be fully de-provisioned and deleted. Subsequent Terraform applies will succeed without errors.

Important: This workaround is safe to perform as the temporary assignment is immediately removed. However, ensure the user or group you use for the dummy assignment does not trigger any automation or notifications in your environment.

---

Best Practices

Before deleting IAM Identity Center permission sets:

• Verify that no active user or group assignments exist using list-account-assignments for all target accounts.
• Check all accounts where the permission set is provisioned using list-accounts-for-provisioned-permission-set.
• Ensure no active sessions are using the permission set before cleanup.

Permission set lifecycle management:

• When removing permission sets via IaC (Terraform, CloudFormation), always remove all account assignments before removing the permission set resource to ensure proper de-provisioning.
• Monitor Terraform apply outputs for ConflictException errors — these indicate orphaned provisioning state.
• Use the create-account-assignment → delete-account-assignment pattern to force de-provisioning when the standard removal flow fails.

General IAM Identity Center cleanup order:

The correct order for deleting a permission set is:

1. Remove all user/group account assignments
2. Verify the permission set is de-provisioned from all target accounts
3. Remove all managed policy attachments
4. Remove all customer managed policy attachments
5. Remove all inline policies
6. Delete the permission set

Finding your IAM Identity Center User or Group ID:

To find a user ID for the temporary assignment:

aws identitystore list-users \
  --identity-store-id "<identity-store-id>" \
  --filters '[{"AttributePath":"UserName","AttributeValue":"<username>"}]'

To find a group ID:

aws identitystore list-groups \
  --identity-store-id "<identity-store-id>" \
  --filters '[{"AttributePath":"DisplayName","AttributeValue":"<group-name>"}]'

---

References

[1] Delete permission sets - IAM Identity Center User Guide https://docs.aws.amazon.com/singlesignon/latest/userguide/howtodeletepermissionset.html

[2] Remove permission sets - IAM Identity Center User Guide https://docs.aws.amazon.com/singlesignon/latest/userguide/howtoremovepermissionset.html

[3] CreateAccountAssignment - AWS SSO Admin API Reference https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_CreateAccountAssignment.html

[4] DeleteAccountAssignment - AWS SSO Admin API Reference https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeleteAccountAssignment.html

[5] DeletePermissionSet - AWS SSO Admin API Reference https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeletePermissionSet.html